---
id: CVE-2017-12172
title: >-
  PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10, 9.4.x
  before 9.4.15, 9.3.x before 9.3.20, and 9.2.x before 9.2.24 runs under a
  non-root operating system account, and database superusers have effective
  ability to run…
summary: >-
  PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10, 9.4.x
  before 9.4.15, 9.3.x before 9.3.20, and 9.2.x before 9.2.24 runs under a
  non-root operating system account, and database superusers have effective
  ability to run…
severity: medium
cvss: 6.7
cvssVector: 'CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-59
vendor: postgresql
product: postgresql
affected:
  - postgresql = 9.2
  - postgresql = 9.2.1
  - postgresql = 9.2.2
  - postgresql = 9.2.3
  - postgresql = 9.2.4
  - postgresql = 9.2.5
  - postgresql = 9.2.6
  - postgresql = 9.2.7
  - postgresql = 9.2.8
  - postgresql = 9.2.9
  - postgresql = 9.2.10
  - postgresql = 9.2.11
  - postgresql = 9.2.12
  - postgresql = 9.2.13
  - postgresql = 9.2.14
  - postgresql = 9.2.15
  - postgresql = 9.2.16
  - postgresql = 9.2.17
  - postgresql = 9.2.18
  - postgresql = 9.2.19
  - postgresql = 9.2.20
  - postgresql = 9.2.21
  - postgresql = 9.2.22
  - postgresql = 9.2.23
  - postgresql = 9.3
  - postgresql = 9.3.1
  - postgresql = 9.3.2
  - postgresql = 9.3.3
  - postgresql = 9.3.4
  - postgresql = 9.3.5
  - postgresql = 9.3.6
  - postgresql = 9.3.7
  - postgresql = 9.3.8
  - postgresql = 9.3.9
  - postgresql = 9.3.10
  - postgresql = 9.3.11
  - postgresql = 9.3.12
  - postgresql = 9.3.13
  - postgresql = 9.3.14
  - postgresql = 9.3.15
  - postgresql = 9.3.16
  - postgresql = 9.3.17
  - postgresql = 9.3.18
  - postgresql = 9.3.19
  - postgresql = 9.4
  - postgresql = 9.4.1
  - postgresql = 9.4.2
  - postgresql = 9.4.3
  - postgresql = 9.4.4
  - postgresql = 9.4.5
  - postgresql = 9.4.6
  - postgresql = 9.4.7
  - postgresql = 9.4.8
  - postgresql = 9.4.9
  - postgresql = 9.4.10
  - postgresql = 9.4.11
  - postgresql = 9.4.12
  - postgresql = 9.4.13
  - postgresql = 9.4.14
  - postgresql = 9.5
  - postgresql = 9.5.1
  - postgresql = 9.5.2
  - postgresql = 9.5.3
  - postgresql = 9.5.4
  - postgresql = 9.5.5
  - postgresql = 9.5.6
  - postgresql = 9.5.7
  - postgresql = 9.5.8
  - postgresql = 9.5.9
  - postgresql = 9.6
  - postgresql = 9.6.1
  - postgresql = 9.6.2
  - postgresql = 9.6.3
  - postgresql = 9.6.4
  - postgresql = 9.6.5
  - postgresql = 10
published: '2017-11-22'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T16:17:26.737'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2017-12172'
references:
  - url: 'http://www.securityfocus.com/bid/101949'
    label: secalert@redhat.com
  - url: 'http://www.securitytracker.com/id/1039752'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2017:3402'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2017:3403'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2017:3404'
    label: secalert@redhat.com
  - url: 'https://access.redhat.com/errata/RHSA-2017:3405'
    label: secalert@redhat.com
  - url: 'https://www.postgresql.org/about/news/1801/'
    label: secalert@redhat.com
  - url: 'https://www.postgresql.org/support/security/'
    label: secalert@redhat.com
  - url: 'http://www.securityfocus.com/bid/101949'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://www.securitytracker.com/id/1039752'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://access.redhat.com/errata/RHSA-2017:3402'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://access.redhat.com/errata/RHSA-2017:3403'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://access.redhat.com/errata/RHSA-2017:3404'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://access.redhat.com/errata/RHSA-2017:3405'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://www.postgresql.org/about/news/1801/'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://www.postgresql.org/support/security/'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
  - cve.org
epss: 0.00586
epssPercentile: 0.4784
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-15T15:51:47.114676Z'
ingestedAt: '2026-10-15T16:13:10.920Z'
---

## Overview

PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10, 9.4.x before 9.4.15, 9.3.x before 9.3.20, and 9.2.x before 9.2.24 runs under a non-root operating system account, and database superusers have effective ability to run arbitrary code under that system account. PostgreSQL provides a script for starting the database server during system boot. Packages of PostgreSQL for many operating systems provide their own, packager-authored startup implementations. Several implementations use a log file name that the database superuser can replace with a symbolic link. As root, they open(), chmod() and/or chown() this log file name. This often suffices for the database superuser to escalate to root privileges when root starts the server.

## Affected

- `postgresql = 9.2`
- `postgresql = 9.2.1`
- `postgresql = 9.2.2`
- `postgresql = 9.2.3`
- `postgresql = 9.2.4`
- `postgresql = 9.2.5`
- `postgresql = 9.2.6`
- `postgresql = 9.2.7`
- `postgresql = 9.2.8`
- `postgresql = 9.2.9`
- `postgresql = 9.2.10`
- `postgresql = 9.2.11`
- `postgresql = 9.2.12`
- `postgresql = 9.2.13`
- `postgresql = 9.2.14`
- `postgresql = 9.2.15`
- `postgresql = 9.2.16`
- `postgresql = 9.2.17`
- `postgresql = 9.2.18`
- `postgresql = 9.2.19`
- `postgresql = 9.2.20`
- `postgresql = 9.2.21`
- `postgresql = 9.2.22`
- `postgresql = 9.2.23`
- `postgresql = 9.3`
- `postgresql = 9.3.1`
- `postgresql = 9.3.2`
- `postgresql = 9.3.3`
- `postgresql = 9.3.4`
- `postgresql = 9.3.5`
- `postgresql = 9.3.6`
- `postgresql = 9.3.7`
- `postgresql = 9.3.8`
- `postgresql = 9.3.9`
- `postgresql = 9.3.10`
- `postgresql = 9.3.11`
- `postgresql = 9.3.12`
- `postgresql = 9.3.13`
- `postgresql = 9.3.14`
- `postgresql = 9.3.15`
- `postgresql = 9.3.16`
- `postgresql = 9.3.17`
- `postgresql = 9.3.18`
- `postgresql = 9.3.19`
- `postgresql = 9.4`
- `postgresql = 9.4.1`
- `postgresql = 9.4.2`
- `postgresql = 9.4.3`
- `postgresql = 9.4.4`
- `postgresql = 9.4.5`
- `postgresql = 9.4.6`
- `postgresql = 9.4.7`
- `postgresql = 9.4.8`
- `postgresql = 9.4.9`
- `postgresql = 9.4.10`
- `postgresql = 9.4.11`
- `postgresql = 9.4.12`
- `postgresql = 9.4.13`
- `postgresql = 9.4.14`
- `postgresql = 9.5`
- `postgresql = 9.5.1`
- `postgresql = 9.5.2`
- `postgresql = 9.5.3`
- `postgresql = 9.5.4`
- `postgresql = 9.5.5`
- `postgresql = 9.5.6`
- `postgresql = 9.5.7`
- `postgresql = 9.5.8`
- `postgresql = 9.5.9`
- `postgresql = 9.6`
- `postgresql = 9.6.1`
- `postgresql = 9.6.2`
- `postgresql = 9.6.3`
- `postgresql = 9.6.4`
- `postgresql = 9.6.5`
- `postgresql = 10`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.